> "idk lol security" reasons. I hereby confess to being guilty of adding autocomplete="off" to a login form, because the client's corporate IT only cared abou

> "idk lol security" reasons. I hereby confess to being guilty of adding autocomplete="off" to a login form, because the client's corporate IT only cared about ticking all the boxes on a security conformance report. We have tried to fight this and some other rules (e.g. log the user out after 20mins), because this was quite a simple website, but the rules were strict like it was online banking at the very least. Now OWASP has changed their mind, but the damage has been done. > Since early 2014 most major browsers will override any use of autocomplete="off" with regards to password forms and as a result previous checks for this are not required and recommendations should not commonly be given for disabling this feature. [1] https://www.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OTG-AUTHN-005) https://www.owasp.org/index.php/Testing_for_Vulnerable_Remem...